Support Library

DNS Anycast Explained

Anycast announces one DNS server address from many sites. What it gives you, what it does not, and how to see which site answered.

Author
CategoryDNS Architecture & Design
Length3 minute read
UpdatedOctober 24, 2026

The short answer

With anycast, the same IP address is announced in BGP from many locations at once. Routers send each packet to whichever announcement is "closest" by routing policy, so a query to 1.1.1.1 from London and one from Sydney reach different servers that share one address. DNS suits anycast well because most queries are a single UDP packet each way, so it does not matter if two queries from the same client land at different sites.

All 13 root server identities, most TLDs, every large public resolver and most managed DNS providers use anycast.

What it gives you

  • Lower latency for most users, since they usually reach a nearby site.
  • Resilience. If a site fails and withdraws its route, traffic moves to the next nearest one without any DNS change.
  • Attack absorption. A flood is split across all sites instead of landing on one, which is why anycast is the standard answer to DNS DDoS.

What it does not do

  • "Closest" means BGP's choice, not geography. Peering and transit policy can send a user to a distant site.
  • It is not redundancy by itself. Several NS names that all use one provider's anycast network still share that provider's software, configuration and BGP announcements. Provider-wide outages have taken down every name server of their customers at once.
  • Routing changes can move traffic mid-stream. That is harmless for UDP queries but can break longer TCP sessions, such as zone transfers or DoT connections, though this is rare in practice.
  • One sick site can affect a region. A site that still announces its route but answers badly sends errors to everyone routed to it, which is hard to see from elsewhere.

Seeing which site answered

CommandWhat it returns
dig +nsid @1.1.1.1 example.com AAn NSID option in the reply naming the server or site, if the operator enables it
dig @1.1.1.1 id.server CH TXTThe traditional server identity query; Cloudflare returns its site code, such as LHR
dig @k.root-servers.net hostname.bind CH TXTThe root server instance you reached

Run the same command from different networks, or use RIPE Atlas probes, to see how the sites are spread.

Using anycast well

For your own domain, the practical decision is choosing a DNS provider with a large anycast network, and deciding whether to add a second provider for independence. Multi-DNS provider strategy covers that trade-off. Running your own anycast network needs your own address space, an AS number, BGP sessions at each site, and health checks that withdraw a site's route when its DNS service fails.

How DNS Panopticon helps

Domain Visualizer lists a domain's name servers and reports when there is only one. It does not test whether those servers are anycast or which sites exist, and it sees them only through the public resolver it uses. Website Recon shows the origin network (AS) of the site's address, which can hint at the hosting provider.

Sources and further reading